CVE-2025-62713: Kottster app reinitialization can be re-triggered allowing command injection in development mode

Development mode only. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.

The vulnerability combines two issues:

1. The initApp action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token
2. The installPackagesForDataSource action uses unescaped command arguments, enabling command injection

An attacker with access to a locally running development instance can chain these vulnerabilities to:

• Reinitialize the application and receive a JWT token for a new root account
• Use this token to authenticate
• Execute arbitrary system commands through installPackagesForDataSource

Production deployments were never affected.